hplip-3.12.4-4.AXS4

The Hewlett-Packard Linux Imaging and Printing Project provides drivers for HP printers and multi-function peripherals.

Security issues fixed with this releaseL:

• CVE-2011-2722
The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.

• CVE-2013-0200
HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.

Fixed bugs:

• The hpijs no longer requires the cupsddk-drivers from the cups package as it sometimes caused hpijs installation to fail.

• The hp-check utility only checked one of the two possible configuration files for the the SANE back end and could incorrectly report a problem. This has been fixed.